Coldcard Hardware Wallet Attack Reaches $116M, Affecting Over 5,200 Addresses

According to Huoxing Finance, the Coldcard hardware wallet attack has expanded to approximately $1.16 billion, with attackers transferring 1,816 BTC from over 5,200 addresses. Galaxy Research confirmed a fourth wave of transfers, revising the amount moved in this wave to approximately 449 BTC. Alex Thorn, head of Galaxy Research, stated that the latest activity may represent a “fourth organized theft,” with transfer rates reaching 13.8 transactions per block—about 45 times the pre-incident baseline. Their analysis suggests the pattern indicates multiple groups may be simultaneously scanning the compromised key space. The root cause has been traced to a firmware update in 2021 for certain Coldcard devices, which changed the wallet seed generation process from a hardware-based random source to a predictable software-based pattern. Canadian manufacturer Coinkite advises users who generated wallet seeds on Coldcard devices to transfer their funds to a new secure wallet as soon as possible.